Privacy policy

1. Data controller

[COMPANY NAME], tax ID [TAX ID], registered office at [ADDRESS]. Privacy contact and data protection officer: dpo@navimask.com.

2. What data we process

Account: first and last name, email address, company, job title, country and your password, which we store transformed with a one-way algorithm and never in readable form.

Organization and team: the organizations you belong to, your role, the invitations you send or receive and a log of team actions (for example who invited whom or who changed a role). If your organization is linked to a managed service provider (MSP), its authorized staff see your name, email address and role.

Audits: the audited domain, the date and the normalized result of each control. We do not keep the content of DNS records or of transferred zones, only aggregate counts.

DMARC reports: if you turn them on, the aggregate reports email providers send about your domain. They include the reporting provider's name, the IP addresses of the servers that sent email on the domain's behalf, the number of messages and the result of each check. Reports arrive at a DomainGuard mailbox, which deletes them once processed.

TLS-RPT reports: if you turn them on, the reports in which email providers say whether they could deliver mail to your domain encrypted. We keep the provider's name, the number of encrypted and failed deliveries, the policy applied, the type of failure and the name and IP address of your own mail server where it failed. We do not keep the sending server's IP address or diagnostic text.

DMARC forensic reports: if your organization turns them on, the reports about specific messages that failed authentication on behalf of your domain, with the original message's headers (sender, subject, date, servers it passed through). Recipient addresses are hidden and we never keep the body or attachments. Only owners, administrators and technicians can see them.

DNS providers: if you connect one, its encrypted credentials, your zone names and the changes you approve and we apply.

White label: the trade name and logo an MSP uploads to show on its clients' reports.

Security: account event logs (for example registration, email confirmation, sign-in or password change) with their date. Your IP address is used temporarily to apply usage limits and the CAPTCHA; if it is blocked for abuse, the block and the IP are recorded in the security log.

Application errors: when something fails, we send our own error-tracking system the type of error and the page, without email addresses, domains, IP addresses, cookies or account data.

Controlled delivery check: if you ask for it, we send a single fixed message to your confirmed mailbox. We do not keep the recipient or the content.

3. Why we use them and on what legal basis

Providing the service you ask for: audits, reports, remediation, monitoring and its alerts, DMARC and TLS-RPT analysis, changes at your DNS provider, managing your account and organization, and the MSP model. Legal basis: performance of the contract.

Sending you the necessary emails, such as account confirmation, invitations, alerts or linking notices: performance of the contract.

Protecting the service against abuse, keeping it secure and fixing errors: legitimate interest.

We do not use your data for advertising or sell it to third parties.

4. Cookies and browser storage

We use strictly necessary technical cookies: "dg_session", which keeps you signed in for 14 days; "dg_csrf", which protects forms; and "sidebar_state", which remembers for 7 days whether the panel's side menu is open.

In your browser we keep the language you chose and the last anonymous audit waiting to be added to your account. For the browser session we also keep the last audited domain, to mention it when you register, and the notice that you have just deleted your account. We do not use analytics or advertising cookies.

5. Who we share them with

DomainGuard runs on Navimask's own servers in Spain, and emails go out from our own mail server, so we do not hand your data to hosting or email providers and there are no international transfers.

Plans are bought in Navimask's online shop, under its own privacy policy (https://navimask.com/privacy). DomainGuard does not receive your card details.

If your organization is linked to an MSP, that MSP accesses its data as described in the terms. We do not share your data with anyone else, except where the law requires it.

6. How long we keep them

Account, organization and audit data are kept while the account is active. Anonymous audits, 12 months. Security logs, 12 months. DMARC and TLS-RPT reports, 365 days, and forensic reports, 90 days; messages with reports arriving at the DomainGuard mailbox, at most 7 days. Application error reports, 12 months. Per-IP usage limits last minutes, and a block at most 24 hours.

Afterwards we delete or anonymize them, unless a law requires us to keep them. We make encrypted backups of the database, kept for up to 12 months; deleted data disappears from them within that period.

7. Your rights

From "My profile" you can download a copy of your data (portability) and delete your account (erasure) at any time. You can also request access, rectification, erasure, objection, restriction of processing and portability by writing to dpo@navimask.com. If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

8. Security

We apply technical and organizational measures to protect your data: passwords transformed with a one-way algorithm, encrypted DNS provider and email credentials, HTTPS connections, session cookies that JavaScript cannot read, single-use links, encrypted backups and restricted access to the data.